Agent environment & secrets
Each project has two ways to pass configuration into the agent process that runs your uploaded bundle: environment variables (plain text) and secrets (encrypted). Both are set in the dashboard on the project overview and applied on the next deploy or session start.
Naming: use the AGENT_ prefix for both
Custom keys for your agent must use the AGENT_ prefix and match AGENT_[A-Z0-9_]+ (uppercase letters, digits, underscore). This applies to both plain variables and secrets — for example AGENT_GREETING or AGENT_OPENAI_API_KEY.
At runtime the platform merges plain variables and decrypted secrets into one environment map for your agent child process. Your code reads them like normal process.env.AGENT_* values.
Environment variables (plain)
- Non-sensitive configuration — greetings, feature flags, model names, etc.
- Values are visible in the dashboard after save (you can update or delete).
- Up to 64 keys per project.
Secrets (encrypted)
- API keys, tokens, and other credentials you do not want stored in plain text.
- Write-once: after creation the plaintext value is never shown again — only a masked suffix (e.g.
••••a1b2). - To change a secret, delete it and create a new entry with the same name.
- Up to 32 secrets per project.
Rules and reserved keys
- A name cannot exist as both a plain variable and a secret — pick one storage type per key.
- The platform sets its own keys for sessions and deploys (for example
SESSION_ID,PROJECT_ID,BUILD_ID). Do not define those asAGENT_*entries.
When values take effect
Changes in the dashboard apply to new agent runs — promote or deploy an active build, or start a new voice session. Running sessions keep the environment they started with.
More guides (quickstart, CLI upload, browser client) are on the way. See the documentation overview for the full list.